# Identity Management ## What is Identity Management? At present, CAS service is mainly used for Identity Management. insureMO CAS enables login to the insureMO platform and applications via third-party identity providers such as Microsoft Entra Id (Azure AD), Okta etc. Additionally, insureMO offers various user source types, such as Platform URP, APP URP, and Member Service and so on, which serve as insureMO IdPs. ### Key Features * **Single Sign-On (SSO)**: Users can access multiple systems (e.g. PA, Claim, LIMO, GIMO, Gemini baseline), without repeated login. * **Federated Identity**: Users can authenticate via external providers(e.g. using Okta accounts to log into insureMO or third-party apps, Microsoft Entra Id (Azure AD), Auth0, Cognito, keycloak etc.). * **User Source Management**: Users can manage security configurations for platform user sources, including MFA, Password Rule, Token Policy and so on. * **Customer Application Management**: Users can manage applications that are seeking to use SAML or OIDC login to access insureMO-based applications. * **Self-Service Portals**: Users can update profiles, reset passwords, or request access without IT assistance. ## Where to Use Identity Management? ### Login The picture below shows the insureMO login page, where CAS is most frequently used. ![1d0c2e94fcf500a23b81f89f71beef9f](./image/cas/login.png) ### SSO: When the user's username and password are stored on an external platform/application, CAS can integrate with it to verify users' passwords, generate tokens, and provide login functionality. The following are the integrated applications and supported protocols (SAML, Oauth2.0, LDAP). ![ec57c218559d94f453b893018424d816](./image/cas/SSO-protocol.png) ### User Source Security Management ![img.png](./image/iam/iam_3.png) ### Customer SSO Applications Management Based on the current insureMO ecosystem, many customers and partners have developed their own applications but lack their own Identity Providers (IdPs). Purchasing third-party SAML/OIDC Identity Providers not only incurs high costs but also requires significant learning efforts for development. insureMO addresses this by offering a comprehensive SAML/OIDC login solution. Users only need to configure SAML/OIDC applications in insureMO to use insureMO as the SAML/OIDC Identity Provider (IDP) for their applications. ![img.png](./image/iam/iam_4.png) ## How to Use Identity Management? ### Log in to insureMO Platform with Your Username and Password - Log in to the insureMO platform using your username and password on the login page. You need to create a user account on the insureMO platform first, and set your own password after receiving the password setting email. ![8c5d9ecdd0abb1b9ef7781a5d6662d9c](./image/cas/login.png) ### Log in to insureMO Platform with Your Company Domain Account - As the CAS service is integrated with the company's domain server, you can enter your own domain account and domain account password on the page. *Note that only usernames ending with \@insuremo.com or \@*****tech.com can go to the company's domain server for password verification.* ![img_1.png](./image/iam/iam_5.png) ### Log in to insureMO Platform via SSO Please visit [insureMO Doc SSO](https://docs.insuremo.com/common/doc_00000366) ### Log in to insureMO Platform with Passkey Passkey is a modern passwordless authentication method that allows you to log in quickly using your fingerprint, face recognition, or device screen lock - no password required. Passkeys are more secure than traditional passwords and effectively protect against phishing attacks. **Prerequisites:** - A browser that supports WebAuthn standard (Chrome, Safari, Edge, or other modern browsers) - A device with biometric authentication capability (Touch ID, Face ID, Windows Hello) or a supported security key **To register a passkey:** 1. After logging in, click the **user avatar** in the top right corner 2. Click **"User Setting"** in the dropdown menu 3. Navigate to **"Manage Passkey"** page 4. Click **"Register New Passkey"** button and follow the prompts **To sign in with passkey:** 1. On the login page, click **"Sign in with Passkey"** button below the password section 2. Complete biometric verification when prompted 3. You will be automatically redirected to the target application For more details, please refer to the [insureMO Passkey User Guide](./InsureMO_Passkey_User_Guide.md). ## Token insureMO provides several types of tokens: ### Oauth2 Token This token is required to access the insureMO webpage. An OAuth2 token is provided upon logging in via the insureMO login page. You can get this token either from the login page or by calling an API with your username and password. ### PAT(Personal Access Token) PAT tokens offer an alternative authentication method. API consumers can create personal access tokens via the management interface. Once created, they can be downloaded and securely stored locally. Personal Access Tokens are designed for API integration for insureMO users. You can apply these tokens in the card (**API Management > Personal Access Tokens**) and specify an expiration date for each token. You can also manage the tokens that have been created and delete them as soon as they are not needed on this page. ![pat-token-page](./image/sso/pat-token-page.png) #### PAT API Scope Authorization PAT tokens can be restricted to specific API scopes for fine-grained access control. This feature allows you to limit which APIs a PAT token can access, providing better security for API integrations. **How it works:** 1. When creating a PAT, you can specify an `extension` field with `api_scope` array 2. APIs in URP V2 can also be configured with `api_scope` in their extension field 3. When a PAT with `api_scope` is used, only APIs with matching scope values are accessible 4. APIs without scope configuration remain unrestricted (backward compatible) **Example:** ```json // Create PAT with api_scope { "name": "my-integration-token", "description": "Token for external integration", "expire_at": "2026-12-31T23:59:59Z", "extension": "{\"api_scope\":[\"print_read\",\"finance_read\"]}" } ``` **API Scope Matching Rules:** - If PAT has `api_scope: ["print_read", "finance_read"]` - And API has `api_scope: ["print_read"]` in its extension - The intersection `["print_read"]` is non-empty → Access allowed - If PAT's `api_scope` is empty or not set → All APIs accessible (no restriction) **Configuration:** - **PAT extension**: Click create in the API Management Personal Access Token menu. ![pat-api-scope-create](./image/sso/pat-api-scope-create.png) - **API extension**: Configure via URP V2 API Management Portal ![pat-api-scope-urp-api](./image/sso/pat-api-scope-urp-api.png) ![pat-api-scope-urp-config](./image/sso/pat-api-scope-urp-config.png) ### JWT Token JSON Web Token(JWT), as a method for authentication, is a compact and self-contained data type for securely transmitting information. The overall structure of JWT data is as follows： > eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9. > eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9. > TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ. ### Common APIs about Token for Platforms - Navigate to the **Token** page, where you perform various token operations through the following panels:
note Before initiating any test, select the environment and token type on the page.
![token-type](./image/sso/token-type.png) #### 1. Get Token - To obtain a **PAT** token, select the **PAT** token type in the previous step. Then, click **Get PAT** that appears on the right. ![token-get-pat_01](./image/sso/token-get-pat_01.png) - This will open a new page where you can **create** a **PAT** token. ![token-get-pat_02](./image/sso/token-get-pat_02.png) - After entering the information in the pop-up creation panel and clicking **Confirm**, a unique **PAT** token will be generated at the bottom of the page.
note Make sure you save the generated **PAT** token immediately, as it won't be accessible again after this step.
![token-get-pat_03](./image/sso/token-get-pat_03.png) - You can get **Oauth2** and **JWT** token in the **Get Token** panel on the **Token** page. - Enter your information and select the **Token Type** you need, then click **Test**. ![token-get_01](./image/sso/token-get_01.png) - On the pop-up **Online Test** page, the information required for the token interface is generated based on the previous step. After clicking **Test**, the corresponding token information will be generated on the right. ![token-get_02](./image/sso/token-get_02.png) #### 2. Validate Token - You can validate the **Oauth2**, **PAT** and **JWT** tokens obtained in the **Get Token** step via the **Validate token** panel on the **Token** page. - Enter your information and click **Test**. ![token-validate_01](./image/sso/token-validate_01.png) - On the pop-up **Online Test** page, the required information for the token validation request has been generated from the previous step. Click **Test**. If the token is valid, the corresponding user information will appear on the right. ![token-validate_02](./image/sso/token-validate_02.png) #### 3. Refresh Token - You can refresh the **JWT** token in the **Refresh Token** panel on the **Token** page. - Enter your information and click **Test**. ![token-refresh_01](./image/sso/token-refresh_01.png) - On the pop-up **Online Test** page, the required information for the token refresh request is generated from the previous step. Clicking **Test** will display new **JWT** token information on the right. ![token-refresh_02](./image/sso/token-refresh_02.png) #### 4. Logout - You can logout the **Oauth2** token in the **Logout** panel on the **Token** page. - Enter your information and click **Test**. ![token-logout_01](./image/sso/token-logout_01.png) - On the pop-up **Online Test** page, the required information for the logout request is generated from the previous step. Clicking **Test** will generate a success message on the right. ![token-logout_02](./image/sso/token-logout_02.png) ## Exchange Code The Exchange Code feature is designed for integration between insureMO web applications across different domains. The steps are as follows: - The first web page will get the exchange code by the user's token. - Redirect to the second web page with the exchange code. - The second web page uses this code to call the validate exchange code API, thereby retrieving the user's information and token. ### Common APIs about Exchange Code for Platforms - Navigate to **Exchange Code** page where you can exchange code through the following panels:
note Before initiating any test, you need to select the environment for test on the page.
![exchange_code-env](./image/sso/exchange_code-env.png) #### 1. Obtain Container Exchange_code according to The Token - You can get exchange code in the **Get Exchange Code** panel on the **Exchange Code** page. - Enter your information and click **Test**. ![exchange_code-get_01](./image/sso/exchange_code-get_01.png) - On the pop-up **Online Test** page, the required information for the exchange code request is generated in the previous step. Clicking **Test** will generate the corresponding exchange code information on the right. ![exchange_code-get_02](./image/sso/token-get_02.png) #### 2. Get The User Information and insureMO Access_token according to Exchange_code - You can validate exchange code in the **Validate Exchange Code** panel on the **Exchange Code** page. - Enter your information and click **Test**. ![exchange_code-validate_01](./image/sso/exchange_code-validate_01.png) - On the pop-up **Online Test** page, the required information for the exchange code request is generated in the previous step. Clicking **Test** will generate the corresponding token and user information on the right. ![exchange_code-validate_02](./image/sso/exchange_code-validate_02.png) # API DOC ### Authentication - HTTP Authentication, scheme: bearer - HOST : Cas Domain Url，for example: https://portal.insuremo.com ## Token APIs ### POST Get Token | API URL | Method | | :----------------------------------------------------------: | :----: | | [https://\[HOST\]/cas/get-token](https://[host]/cas/get-token) | POST | #### Body Parameters ```json { "tenant_code": "tenant", "username": "test", "password": "XXXXXXXX", "disable_auto_refresh_token": "", "extend_params": null, "user_source_id": "mo", "token_type": "oauth2", "expire_in": 0 } ```
note The `user_source_id` currently supported by the platform is as follows: 1. **'mo'**: Indicates the platform's default URP. 2. **'platform'**: Indicates GIMO's URP. 3. **'member'**: Indicates GIMO member service. 4. **'limo'**: Indicates LIMO's URP. 5. **'jpmember'**: Indicates Japan Cloud member service. The supported token types include: 1. **'oauth2'**: The default OAuth2 access token, formatted as 9OunkcHkRQaPkkjF-6aIUA. 2. **'jwt'**: JWT token (for details, see the previous documentation). 3. **'id'**: ID token, returned when using insureMO as the OIDC server.
#### Response Examples Upon successful requests, the access_token and related information will be returned; otherwise, the request will fail. * Oauth2 ```json { "access_token": "XXXXXXXXXXXXXXXXXXXXXX", "expire_in": 1880, "message": "", "retry_times": 0, "authResult": true, "auth_result": true, "trace_id": "3d37cxxxxxxxxxxxxxxxxxxxxxx75bf" } ``` * JWT ```json { "access_token": "", "expire_in": 0, "message": "", "retry_times": 0, "authResult": true, "auth_result": true, "trace_id": "500xxxxxxxxxxxxxxxxxxxxxx23fd91", "jwt_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxtxlimHyfWc1zLTBCH6OoxoxRyxjLhXqn6qXosqGKcg" } ``` * ID ```json { "access_token": "vuGHnB-gSNC-lxbfkNY9Lw", "expire_in": 7211, "message": "", "err_code": "", "retry_times": 0, "authResult": true, "auth_result": true, "trace_id": "d09xxxxxxxxxxxxxxxxxxxxxxxxxxxx26489ee", "id_token": "eyJhbxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx4WaSVnPQ4g" } ``` ### POST Validate Token | API URL | Method | | :----------------------------------------------------------: | :----: | | [https://\[HOST\]/cas/validate-token](https://[host]/cas/validate-token) | POST | #### Header | Parameter | Value | | :----------------: | :-------------------------------------------: | | Authorization | Bearer XXXXXXXXXXXXXXXXXXXXXX | #### Response Examples Upon successful requests, the user's information corresponding to the token is returned; otherwise, the request fails. * Oauth2 ```json { "user_name": "test", "tenant_code": "tenant", "status": "SUCCESS", "email": "sample@sample.com", "accountExpireDate": "0001-01-01T00:00:00Z", "account_expire_date": "0001-01-01T00:00:00Z", "client_id": "client", "user_source_id": "source" } ``` * JWT or PAT ```json { "user_name": "betty.ddd@**tech.com", "tenant_code": "**tech", "status": "SUCCESS", "user_source_id": "" } ``` ### POST Refresh-token JWT | API URL | Method | | :----------------------------------------------------------: | :----: | | [https://\[HOST\]/cas/refresh-token](https://[host]/cas/refresh-token) | POST | #### Body Parameters ```json { "token": "eyJhbGcxxxxxxxxxxxxxxxxxxxx.exxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNb775TdZOjQk4wdWQ", "expire_in":7200 } ``` #### Response Examples Upon successful requests, a new JWT token and related information will be returned; otherwise, the request will fail. ```json { "message": "", "token": "eyJhbGcxxxxxxxxxxxxxxxxxxxx.exxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNb775TdZOjQk4wdWQ", "expire_in": 7200 } ``` ### POST Logout Token | API URL | Method | | :----------------------------------------------------------: | :----: | | [https://\[HOST\]/cas/logout](https://[host]/cas/logout) | POST | #### Header | Parameter | Value | | :----------------: | :-------------------------------------------: | | Authorization | Bearer XXXXXXXXXXXXXXXXXXXXXX(Oauth2 token) | ### Params |Name|Location|Type|Required|Description| |---|---|---|---|---| |format|query|string| no |Example: json| #### Response Examples Upon successful requests, the status returned is "SUCCESS"; otherwise, the request fails. ```json { "status": "SUCCESS", "statusCode": 200 } ``` By default, if the format parameter is not provided, the response will be the CAS default login page. ## Exchange Code APIs ### POST Get Exchange_code | API URL | Method | | :----------------------------------------------------------: | :----: | | [https://\[HOST\]/cas/oauth2.0/v2/prepare](https://[host]/cas/oauth2.0/v2/prepare) | POST | #### Header | Parameter | Value | | :----------------: | :-------------------------------------------: | | Authorization | Bearer XXXXXXXXXXXXXXXXXXXXXX(Oauth2 token) | #### Response Examples Upon successful requests, the status returned is **SUCCESS** and the exchange code corresponding to the token is returned; otherwise, the request fails. ```json { "data": { "exchange_code": "9e42xxxxxxxxxxxx2259b9a5" }, "status": "SUCCESS", "status_code": 200 } ``` ### POST Validate Exchange_code | API URL | Method | | :----------------------------------------------------------: | :----: | | [https://\[HOST\]/cas/oauth2.0/v2/consume](https://[host]/cas/oauth2.0/v2/consume) | POST | ### Params |Name|Location|Type|Required|Description| |---|---|---|---|---| |exchange_code|query|string| no |Example: 5f16f718fae541109dc9eb4a0a231125| #### Response Examples Upon successful requests, the status returned is **SUCCESS**, the token and user's information corresponding to the exchange code are returned; otherwise, the request fails. ```json { "data": { "access_token": "0SXXXXXXXXXXXXXXXXVrVw", "account_name": "sample@sample.com", "auth_code": "c3fee004-7b8b-441f-89f0-0201cff0a96a", "option": "", "tenant_code": "tenant" }, "status": "SUCCESS", "status_code": 200 } ``` #### Error Response Upon failed requests, the status returned is **ERROR** and the error detail is returned in the `errors` array. The HTTP status code remains `200`; always determine the result via the `status` field. ```json { "errors": [ { "code": "99", "message": "get token error:" } ], "status": "ERROR", "status_code": 599 } ``` The `message` varies by failure scenario: `token not found` when `exchange_code` is missing; `get token error:` when the exchange code is invalid, expired, already consumed, or its bound token is no longer valid. ## PAT Token APIs All PAT APIs share the gateway path prefix `/mo-fo/v1` and require the OAuth2 token of the operating user in the `Authorization` header. The created PAT value is prefixed with `MOGT`. The plaintext token is returned **only once** in the create response — store it securely at creation time. Error codes: | code | HTTP status | meaning | |---|---|---| | w_access_token_bad_request | 499 | invalid request body or missing required parameter | | e_access_token_create_failed | 599 | token creation failed | ### POST Create PAT POST https://\[HOST\]/mo-fo/v1/gateway/v3/access/token/create-one Creates a personal access token for the current user. #### Header | Parameter | Value | | :----------------: | :-------------------------------------------: | | Authorization | Bearer {access_token} | #### Body Parameters ```json { "name": "ci-cd-token", "description": "token for CI/CD pipeline", "expire_at": "2026-12-31T00:00:00Z", "extension": "{\"api_scope\": [\"ai_read\"]}" } ``` #### Params |Name|Type|Required|Description| |---|---|---|---| |name|string|yes|token name| |description|string|no|free text| |expire_at|string (date-time)|no|expiration time; null or omitted = never expires| |extension|string|no|JSON string, e.g. `{"api_scope": [...]}` restricting which APIs the PAT can access| #### Response Examples ```json { "code": "i_common_success", "message": "request success", "trace_id": "143ba09243343912906673a0b7a261af", "data": { "id": "c99a1c8b-e5ab-4415-8d29-04a34484a660", "name": "ci-cd-token", "description": "token for CI/CD pipeline", "username": "demo.user", "tenant": "mo-fo", "token": "MOGTXXXXXXXXXXXXXXXXXXXXXXXX", "times_use": 0, "last_use_time": null, "expire_at": "2026-12-31T00:00:00Z", "extension": "{\"api_scope\": [\"ai_read\"]}", "creator": "demo.user", "create_time": "2026-09-21T08:55:39.787227308Z", "modifier": "demo.user", "modify_time": "2026-09-21T08:55:39.787227308Z", "memo": "" } } ``` ```json { "code": "w_access_token_bad_request", "message": "invalid request body: name is required", "trace_id": "3010XXXXXXXXXXXXXXXXXXXXXXXX7749c" } ```
note Existing tokens can be managed — viewed, scope-updated, and revoked — on the **API Management > Personal Access Tokens** page.
## Password APIs ### POST forget password v2 POST https://\[HOST\]/cas/v2/password/forgot-password > Body Parameters ```json { "account_name_v2": "testuser", "email": "testuser@***.com", "tenant_code_v2": "foundation", "redirect_uri": "https://dev.insuremo.com/", "tenant_uri": "https%3A%2F%2Flib-gi-dev.insuremo.com%2Fui%2Fadmin%2F", "user_source_id": "mo" } ``` #### Params |Name|Location|Type|Required|Description| |---|---|---|---|---| |body|body|object| no |none| > Response Examples ```json { "code": "i_common_success", "message": "request success", "trace_id": "79XXXXXXXXXXXXXXXXXXXXXXXXX71057" } ``` ```json { "code": "w_user_account_notexist", "message": "Account not exist!", "trace_id": "3010XXXXXXXXXXXXXXXXXXXXXXXX7749c" } ``` #### Responses |HTTP Status Code |Meaning|Description|Data schema| |---|---|---|---| |200|[OK](https://tools.ietf.org/html/rfc7231#section-6.3.1)|none|Inline| ### POST set password v2 POST https://\[HOST\]/cas/v2/password/set-password > Body Parameters ```json { "account_name_v2": "testtenant.test", "callback_id": "61301deb-85d2-4d12-bc9a-bccd9e1daf47", "tenant_code_v2": "testtenant", "password": "******!" } ``` #### Params |Name|Location|Type|Required|Description| |---|---|---|---|---| |body|body|object| no |none| > Response Examples > 200 Response ```json { "code": "i_common_success", "message": "request success", "trace_id": "1f3dXXXXXXXXXXXXXXXXXXXXXXbb9cf95" } ``` #### Responses |HTTP Status Code |Meaning|Description|Data schema| |---|---|---|---| |200|[OK](https://tools.ietf.org/html/rfc7231#section-6.3.1)|none|Inline| ### POST change password by userself POST https://\[HOST\]/cas/v2/password/change-password > Body Parameters ```json { "account_name_v2":"signintestdev001", "old_password":"DFSAFDAS2SX!", "tenant_code_v2":"test", "password":"DFDSAFDSA!" } ``` #### Params |Name|Location|Type|Required|Description| |---|---|---|---|---| |password_status|query|string| no |none| |x-mo-user-source-id|header|string| no |none| |body|body|object| no |none| > Response Examples > 200 Response ```json { "code": "i_common_success", "message": "request success", "trace_id": "1f3d3XXXXXXXXXXXXXXXXXXXXbb9cf95" } ``` #### Responses |HTTP Status Code |Meaning|Description|Data schema| |---|---|---|---| |200|[OK](https://tools.ietf.org/html/rfc7231#section-6.3.1)|none|Inline| #### Responses Data Schema ### POST forget password by admin POST https://\[HOST\]/cas/v2/password/forgot-password-admin > Body Parameters ```json { "account_name_v2": "sdAFSEDFD@EEED.plus", "tenant_code_v2": "test", "email": "testuser@****tech.com", "user_source_id": "jpmember" } ``` #### Params |Name|Location|Type|Required|Description| |---|---|---|---|---| |body|body|object| no |none| > Response Examples ```json { "code": "i_common_success", "message": "request success", "trace_id": "796XXXXXXXXXXXXXXXXXXXXXXXc71057" } ``` ```json { "code": "w_user_account_notexist", "message": "Account not exist!", "trace_id": "301XXXXXXXXXXXXXXXXXXXXXXXX7749c" } ``` #### Responses |HTTP Status Code |Meaning|Description|Data schema| |---|---|---|---| |200|[OK](https://tools.ietf.org/html/rfc7231#section-6.3.1)|none|Inline| ### POST set password by admin user POST https://\[HOST\]/cas/v2/password/admin/set-password > Body Parameters ```json { "tenant_code_v2": "tenantcode", "account_name_v2": "password.testuser", "password": "******!", "user_source_id": "mo" } ``` #### Params |Name|Location|Type|Required|Description| |---|---|---|---|---| |body|body|object| no |none| > Response Examples > 200 Response ```json { "code": "i_common_success", "message": "request success", "trace_id": "1f3XXXXXXXXXXXXXXXXXXXXX91bb9cf95" } ``` #### Responses |HTTP Status Code |Meaning|Description|Data schema| |---|---|---|---| |200|[OK](https://tools.ietf.org/html/rfc7231#section-6.3.1)|none|Inline| ### POST reset-random-password by admin POST https://\[HOST\]/cas/v2/password/admin/reset-random-password > Body Parameters ```json { "account_name_v2": "password.testuser", "tenant_code_v2": "tenantcode", "user_source_id": "mo" } ``` #### Params |Name|Location|Type|Required|Description| |---|---|---|---|---| |body|body|object| no |none| > Response Examples > 200 Response ```json { "code": "i_common_success", "message": "request success", "trace_id": "599XXXXXXXXXXXXXXXXXXXXXXXb1d29", "env_name": "env name", "date": "2025-04-27T06:38:09.141Z", "data": { "account_name_v2": "password.testuser", "tenant_code_v2": "tenantcode", "password": "yA1(aaDddp", "email": "", "user_source_id": "mo" } } ``` #### Responses |HTTP Status Code |Meaning|Description|Data schema| |---|---|---|---| |200|[OK](https://tools.ietf.org/html/rfc7231#section-6.3.1)|none|Inline| ### POST get password change history POST https://\[HOST\]/cas/v2/password/admin/get-password-history > Body Parameters ```json { "account_name_v2": "testuser", "tenant_code_v2": "foundation", "user_source_id": "mo" } ``` #### Params |Name|Location|Type|Required|Description| |---|---|---|---|---| |body|body|object| no |none| > Response Examples > 200 Response ```json { "code": "i_common_success", "message": "request success", "trace_id": "", "env_name": "env name", "date": "2025-04-27T06:30:17.456Z", "data": [ { "account_name": "foundation.root", "tenant_code": "foundation", "user_source_id": "mo", "create_time": "2024-12-05T07:10:09Z" } ] } ``` > 499 Response > ```json {"code": "w_cas_notmatch_tenant_token", "message": "Check token user permission failed,not tenant admin!", "trace_id": "bfdXXXXXXXXXXXXXXXXXXXX677d1", "env_name": "env name", "date": "2025-04-27T06:07:44.354Z" } ``` #### Responses |HTTP Status Code |Meaning|Description|Data schema| |---|---|---|---| |200|[OK](https://tools.ietf.org/html/rfc7231#section-6.3.1)|none|Inline| ### POST clean password change history POST https://\[HOST\]/cas/v2/password/admin/clean-password-history > Body Parameters ```json { "account_name": "txxxx@maxxxx.plus", "tenant_code": "poseidon", "account_name_v2": "txxxx@maxxxx.plus", "tenant_code_v2": "poseidon", "email": "testuser@***.com", "user_source_id": "jpmember" } ``` #### Params |Name|Location|Type|Required|Description| |---|---|---|---|---| |body|body|object| no |none| > Response Examples > 200 Response ```json { "code": "i_common_success", "message": "request success", "trace_id": "1f3xxxxxxxxxxxxxxxxxxxxxxxx9cf95" } ``` #### Responses |HTTP Status Code |Meaning|Description|Data schema| |---|---|---|---| |200|[OK](https://tools.ietf.org/html/rfc7231#section-6.3.1)|none|Inline| ## Lock APIs ### POST get locked users POST https://\[HOST\]/cas/admin/locked-users > Body Parameters ```json { "tenant_code": "test", "user_source_id": "mo", "client_id": "key" } ``` #### Params |Name|Location|Type|Required|Description| |---|---|---|---|---| |Content-Type|header|string| yes |-| |Authorization|header|string| yes |-| |body|body|object| no |none| > Response Examples > 200 Response ```json [ { "user_name": "test", "tenant_code": "test", "client_id": "key", "ip": "172.29.1.34", "unlock_id": "NzBjXXXXXXXXXXXXXXXXXXXXXXSTY3", "execute_time": "2025-04-27 07:00:50.102206357 +0000 UTC", "user_source_id": "mo", "email": "test@insuremo.com", "user_agent": "Apifox/1.0.0 (https://apifox.com)" } ] ``` #### Responses |HTTP Status Code |Meaning|Description|Data schema| |---|---|---|---| |200|[OK](https://tools.ietf.org/html/rfc7231#section-6.3.1)|none|Inline| ### POST unlock user POST https://\[HOST\]/cas/admin/unlock > Body Parameters ```json { "user_name": "testuser1", "tenant_code": "lib", "user_source_id": "platform", "client_id": "key" } ``` #### Params |Name|Location|Type|Required|Description| |---|---|---|---|---| |body|body|object| no |none| > Response Examples > 200 Response ```json { "code": "i_common_success", "message": "request success", "trace_id": "1f3dxxxxxxxxxxxxxxxxxxxxxxx9cf95" } ``` > 499 Response ```json { "code": "w_cas_notmatch_tenant_token", "message": "Check token user permission failed,not tenant admin!", "trace_id": "bfdXXXXXXXXXXXXXXXXXXXXXXXX77d1", "env_name": "env name", "date": "2025-04-27T06:07:44.354Z" } ``` #### Responses |HTTP Status Code |Meaning|Description|Data schema| |---|---|---|---| |200|[OK](https://tools.ietf.org/html/rfc7231#section-6.3.1)|none|Inline| |499|Unknown|none|Inline|
note This document may contain links to external websites and third-party features for demonstration only. These links and features don't imply our endorsement or recommendation. We are not responsible for the content, services, or privacy practices of these third parties. Users are advised to review the relevant terms and privacy policies independently.